Merge "Revert^2 "Adding sepolicy rules for CrashRecoveryProperties"" into main
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index d32cc2c..7f1f0be 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -158,6 +158,7 @@
 		"account":            EXCEPTION_NO_FUZZER,
 		"activity":           EXCEPTION_NO_FUZZER,
 		"activity_task":      EXCEPTION_NO_FUZZER,
+		"adaptive_auth":      EXCEPTION_NO_FUZZER,
 		"adb":                EXCEPTION_NO_FUZZER,
 		"adservices_manager": EXCEPTION_NO_FUZZER,
 		"aidl_lazy_test_1":   EXCEPTION_NO_FUZZER,
diff --git a/microdroid/system/private/genfs_contexts b/microdroid/system/private/genfs_contexts
index f55711e..13ce685 100644
--- a/microdroid/system/private/genfs_contexts
+++ b/microdroid/system/private/genfs_contexts
@@ -7,6 +7,9 @@
 genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
 genfscon proc /cmdline u:object_r:proc_cmdline:s0
 genfscon proc /config.gz u:object_r:config_gz:s0
+genfscon proc /device-tree/avf u:object_r:proc_dt_avf:s0
+genfscon proc /device-tree/chosen/avf,new-instance u:object_r:proc_dt_avf:s0
+genfscon proc /device-tree/chosen/avf,strict-boot u:object_r:proc_dt_avf:s0
 genfscon proc /diskstats u:object_r:proc_diskstats:s0
 genfscon proc /filesystems u:object_r:proc_filesystems:s0
 genfscon proc /interrupts u:object_r:proc_interrupts:s0
diff --git a/microdroid/system/private/init_debug_policy.te b/microdroid/system/private/init_debug_policy.te
index a9c5f4a..384f5d5 100644
--- a/microdroid/system/private/init_debug_policy.te
+++ b/microdroid/system/private/init_debug_policy.te
@@ -27,6 +27,5 @@
 set_prop(init_debug_policy, init_debug_policy_prop)
 
 # Allow init_debug_policy to read AVF debug policy
-allow init_debug_policy sysfs_dt_avf:dir search;
-allow init_debug_policy sysfs_dt_avf:file r_file_perms;
-
+r_dir_file(init_debug_policy, proc_dt_avf)
+r_dir_file(init_debug_policy, sysfs_dt_avf)
diff --git a/microdroid/system/private/microdroid_manager.te b/microdroid/system/private/microdroid_manager.te
index b84474a..d1a5c6f 100644
--- a/microdroid/system/private/microdroid_manager.te
+++ b/microdroid/system/private/microdroid_manager.te
@@ -18,10 +18,8 @@
 allow microdroid_manager dm_device:blk_file r_file_perms;
 
 # microdroid_manager can query AVF flags in the device tree
-allow microdroid_manager sysfs_dt_avf:file r_file_perms;
-
-# Allow microdroid_manager to read AVF debug policy
-allow microdroid_manager sysfs_dt_avf:dir search;
+r_dir_file(microdroid_manager, proc_dt_avf)
+r_dir_file(microdroid_manager, sysfs_dt_avf)
 
 # Read config from the open-dice driver.
 allow microdroid_manager open_dice_device:chr_file rw_file_perms;
diff --git a/microdroid/system/public/file.te b/microdroid/system/public/file.te
index 57852c2..201a07e 100644
--- a/microdroid/system/public/file.te
+++ b/microdroid/system/public/file.te
@@ -84,6 +84,7 @@
 type proc_dirty, fs_type, proc_type;
 type proc_diskstats, fs_type, proc_type;
 type proc_drop_caches, fs_type, proc_type;
+type proc_dt_avf, fs_type, proc_type;
 type proc_extra_free_kbytes, fs_type, proc_type;
 type proc_filesystems, fs_type, proc_type;
 type proc_hostname, fs_type, proc_type;
diff --git a/prebuilts/api/33.0/public/vold.te b/prebuilts/api/33.0/public/vold.te
index 53b2c49..b49f25f 100644
--- a/prebuilts/api/33.0/public/vold.te
+++ b/prebuilts/api/33.0/public/vold.te
@@ -328,6 +328,7 @@
 neverallow vold {
   domain
   -hal_health_storage_server
+  -hal_keymaster_server
   -system_suspend_server
   -hal_bootctl_server
   -hwservicemanager
diff --git a/private/compat/34.0/34.0.cil b/private/compat/34.0/34.0.cil
index b10103e..595d53e 100644
--- a/private/compat/34.0/34.0.cil
+++ b/private/compat/34.0/34.0.cil
@@ -1,6 +1,9 @@
 ;; types removed from current policy
 (type racoon)
 (type racoon_exec)
+(type mtp_exec)
+(type ppp_device)
+(type ppp_exec)
 
 ;; mapping information from ToT policy's types to 34.0 policy's types.
 (expandtypeattribute (DockObserver_service_34_0) true)
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index c1cd3ee..b9dfe5a 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -30,7 +30,6 @@
     tv_ad_service
     threadnetwork_service
     device_config_aconfig_flags_prop
-    proc_memhealth
     virtual_device_native_service
     next_boot_prop
     binderfs_logs_stats
diff --git a/private/crosvm.te b/private/crosvm.te
index ed89b87..6cd3969 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -45,9 +45,6 @@
 # Allow searching the directory where the composite disk images are.
 allow crosvm virtualizationservice_data_file:dir search;
 
-# Allow crosvm to mlock guest memory.
-allow crosvm self:capability ipc_lock;
-
 # Let crosvm access its control socket as created by VS.
 #   read, write, getattr: listener socket polling
 #   accept: listener socket accepting new connection
diff --git a/private/file.te b/private/file.te
index b652ccb..450fe2c 100644
--- a/private/file.te
+++ b/private/file.te
@@ -136,8 +136,9 @@
 # in to satisfy MLS constraints for trusted domains.
 type prng_seeder_socket, file_type, coredomain_socket, mlstrustedobject;
 
-# /sys/firmware/devicetree/base/avf
+# /proc/device-tree/avf and /sys/firmware/devicetree/base/avf
 type sysfs_dt_avf, fs_type, sysfs_type;
+type proc_dt_avf, fs_type, proc_type;
 
 # Type for /system/fonts/font_fallback.xm
 type system_font_fallback_file, system_file_type, file_type;
diff --git a/private/file_contexts b/private/file_contexts
index 765bb7b..cba5660 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -141,7 +141,6 @@
 /dev/pmsg0		u:object_r:pmsg_device:s0
 /dev/pn544		u:object_r:nfc_device:s0
 /dev/port		u:object_r:port_device:s0
-/dev/ppp		u:object_r:ppp_device:s0
 /dev/ptmx		u:object_r:ptmx_device:s0
 /dev/pvrsrvkm		u:object_r:gpu_device:s0
 /dev/kmsg		u:object_r:kmsg_device:s0
@@ -166,7 +165,6 @@
 /dev/socket/statsdw	u:object_r:statsdw_socket:s0
 /dev/socket/mdns	u:object_r:mdns_socket:s0
 /dev/socket/mdnsd	u:object_r:mdnsd_socket:s0
-/dev/socket/mtpd	u:object_r:mtpd_socket:s0
 /dev/socket/ot-daemon(/.*)?  u:object_r:ot_daemon_socket:s0
 /dev/socket/pdx/system/buffer_hub	u:object_r:pdx_bufferhub_dir:s0
 /dev/socket/pdx/system/buffer_hub/client	u:object_r:pdx_bufferhub_client_endpoint_socket:s0
@@ -319,8 +317,6 @@
 /system/bin/dhcpcd      u:object_r:dhcp_exec:s0
 /system/bin/dhcpcd-6\.8\.2	u:object_r:dhcp_exec:s0
 /system/bin/dmesgd	u:object_r:dmesgd_exec:s0
-/system/bin/mtpd	u:object_r:mtp_exec:s0
-/system/bin/pppd	u:object_r:ppp_exec:s0
 /system/xbin/su		u:object_r:su_exec:s0
 /system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
 /system/bin/linker(64)? u:object_r:system_linker_exec:s0
diff --git a/private/genfs_contexts b/private/genfs_contexts
index b5f07ec..e4baeee 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -8,6 +8,7 @@
 genfscon proc /cmdline u:object_r:proc_cmdline:s0
 genfscon proc /config.gz u:object_r:config_gz:s0
 genfscon proc /cpu/alignment u:object_r:proc_cpu_alignment:s0
+genfscon proc /device-tree/avf u:object_r:proc_dt_avf:s0
 genfscon proc /diskstats u:object_r:proc_diskstats:s0
 genfscon proc /filesystems u:object_r:proc_filesystems:s0
 genfscon proc /interrupts u:object_r:proc_interrupts:s0
@@ -19,7 +20,6 @@
 genfscon proc /locks u:object_r:proc_locks:s0
 genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0
 genfscon proc /meminfo u:object_r:proc_meminfo:s0
-genfscon proc /memhealth u:object_r:proc_memhealth:s0
 genfscon proc /misc u:object_r:proc_misc:s0
 genfscon proc /modules u:object_r:proc_modules:s0
 genfscon proc /mounts u:object_r:proc_mounts:s0
diff --git a/private/mtp.te b/private/mtp.te
deleted file mode 100644
index 732e111..0000000
--- a/private/mtp.te
+++ /dev/null
@@ -1,3 +0,0 @@
-typeattribute mtp coredomain;
-
-init_daemon_domain(mtp)
diff --git a/private/ppp.te b/private/ppp.te
deleted file mode 100644
index 968b221..0000000
--- a/private/ppp.te
+++ /dev/null
@@ -1,3 +0,0 @@
-typeattribute ppp coredomain;
-
-domain_auto_trans(mtp, ppp_exec, ppp)
diff --git a/private/property_contexts b/private/property_contexts
index 2812556..aa15633 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -631,6 +631,7 @@
 
 bluetooth.core.le.vendor_capabilities.enabled        u:object_r:bluetooth_config_prop:s0 exact bool
 bluetooth.sco.disable_enhanced_connection            u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.sco.managed_by_audio                       u:object_r:bluetooth_config_prop:s0 exact bool
 bluetooth.core.le.dsa_transport_preference           u:object_r:bluetooth_config_prop:s0 exact string
 
 persist.nfc.debug_enabled                      u:object_r:nfc_prop:s0 exact bool
diff --git a/private/service.te b/private/service.te
index e97eb8c..36d6ccf 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,3 +1,4 @@
+type adaptive_auth_service,         system_server_service, service_manager_type;
 type ambient_context_service,       app_api_service, system_server_service, service_manager_type;
 type attention_service,             system_server_service, service_manager_type;
 type bg_install_control_service,    system_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 66215bc..863ffde 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -139,6 +139,7 @@
 account                                   u:object_r:account_service:s0
 activity                                  u:object_r:activity_service:s0
 activity_task                             u:object_r:activity_task_service:s0
+adaptive_auth                             u:object_r:adaptive_auth_service:s0
 adb                                       u:object_r:adb_service:s0
 adservices_manager                        u:object_r:adservices_manager_service:s0
 aidl_lazy_test_1                          u:object_r:aidl_lazy_test_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index d4ce559..9ea2e9f 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -260,7 +260,6 @@
 
 # Talk to init and various daemons via sockets.
 unix_socket_connect(system_server, lmkd, lmkd)
-unix_socket_connect(system_server, mtpd, mtp)
 unix_socket_connect(system_server, zygote, zygote)
 unix_socket_connect(system_server, uncrypt, uncrypt)
 
@@ -309,6 +308,7 @@
 hal_client_domain(system_server, hal_audio)
 hal_client_domain(system_server, hal_authgraph)
 hal_client_domain(system_server, hal_authsecret)
+hal_client_domain(system_server, hal_bluetooth)
 hal_client_domain(system_server, hal_broadcastradio)
 hal_client_domain(system_server, hal_codec2)
 hal_client_domain(system_server, hal_configstore)
@@ -1139,7 +1139,6 @@
 allow system_server dmabuf_system_secure_heap_device:chr_file r_file_perms;
 
 r_dir_file(system_server, proc_asound)
-r_dir_file(system_server, proc_memhealth)
 r_dir_file(system_server, proc_net_type)
 r_dir_file(system_server, proc_qtaguid_stat)
 allow system_server {
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index d0fe571..3aaff5b 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -83,9 +83,9 @@
 allow virtualizationmanager tombstone_data_file:file { append getattr };
 allow virtualizationmanager tombstoned:fd use;
 
-# Allow virtualizationmanager to read AVF debug policy
-allow virtualizationmanager sysfs_dt_avf:dir search;
-allow virtualizationmanager sysfs_dt_avf:file r_file_perms;
+# Allow virtualizationmanager to read file system DT for VM reference DT and AVF debug policy
+r_dir_file(virtualizationmanager, proc_dt_avf)
+r_dir_file(virtualizationmanager, sysfs_dt_avf)
 
 # virtualizationmanager to be client of secretkeeper HAL. It ferries SecretManagement messages
 # from pVM to HAL.
diff --git a/public/file.te b/public/file.te
index 2a84dd0..32c0cd8 100644
--- a/public/file.te
+++ b/public/file.te
@@ -48,7 +48,6 @@
 type proc_lowmemorykiller, fs_type, proc_type;
 type proc_max_map_count, fs_type, proc_type;
 type proc_meminfo, fs_type, proc_type;
-type proc_memhealth, fs_type, proc_type;
 type proc_misc, fs_type, proc_type;
 type proc_modules, fs_type, proc_type;
 type proc_mounts, fs_type, proc_type;
diff --git a/public/hal_neverallows.te b/public/hal_neverallows.te
index e77ea9d..621a0b8 100644
--- a/public/hal_neverallows.te
+++ b/public/hal_neverallows.te
@@ -33,6 +33,7 @@
   # TODO(b/196225233): Remove hal_uwb_vendor_server
   -hal_uwb_vendor_server
   -hal_nlinterceptor_server
+  -hal_bluetooth_server
 } domain:{ udp_socket rawip_socket } *;
 
 neverallow {
@@ -45,6 +46,7 @@
   -hal_wifi_supplicant_server
   -hal_telephony_server
   -hal_nlinterceptor_server
+  -hal_bluetooth_server
 } {
   domain
   userdebug_or_eng(`-su')
diff --git a/public/mediaswcodec.te b/public/mediaswcodec.te
index b3b26c1..dc45500 100644
--- a/public/mediaswcodec.te
+++ b/public/mediaswcodec.te
@@ -11,6 +11,9 @@
 hal_client_domain(mediaswcodec, hal_allocator)
 hal_client_domain(mediaswcodec, hal_graphics_allocator)
 
+# get aac_drc_* properties
+get_prop(mediaswcodec, aac_drc_prop)
+
 crash_dump_fallback(mediaswcodec)
 
 # mediaswcodec_server should never execute any executable without a
diff --git a/public/mtp.te b/public/mtp.te
index add63c0..4f3ce9a 100644
--- a/public/mtp.te
+++ b/public/mtp.te
@@ -1,11 +1,2 @@
 # vpn tunneling protocol manager
 type mtp, domain;
-type mtp_exec, system_file_type, exec_type, file_type;
-
-net_domain(mtp)
-
-# pptp policy
-allow mtp self:{ socket pppox_socket } create_socket_perms_no_ioctl;
-allow mtp self:global_capability_class_set net_raw;
-allow mtp ppp:process signal;
-allow mtp vpn_data_file:dir search;
diff --git a/public/ppp.te b/public/ppp.te
index b736def..29900ea 100644
--- a/public/ppp.te
+++ b/public/ppp.te
@@ -1,23 +1,2 @@
 # Point to Point Protocol daemon
 type ppp, domain;
-type ppp_device, dev_type;
-type ppp_exec, system_file_type, exec_type, file_type;
-
-net_domain(ppp)
-
-r_dir_file(ppp, proc_net_type)
-
-allow ppp mtp:{ socket pppox_socket } rw_socket_perms;
-
-# ioctls needed for VPN.
-allowxperm ppp self:udp_socket ioctl priv_sock_ioctls;
-allowxperm ppp mtp:{ socket pppox_socket } ioctl ppp_ioctls;
-
-allow ppp mtp:unix_dgram_socket rw_socket_perms;
-allow ppp ppp_device:chr_file rw_file_perms;
-allow ppp self:global_capability_class_set net_admin;
-allow ppp system_file:file rx_file_perms;
-not_full_treble(`allow ppp vendor_file:file rx_file_perms;')
-allow ppp vpn_data_file:dir w_dir_perms;
-allow ppp vpn_data_file:file create_file_perms;
-allow ppp mtp:fd use;
diff --git a/public/vold.te b/public/vold.te
index c0fdf50..ad6ef83 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -338,6 +338,7 @@
 neverallow vold {
   domain
   -hal_health_storage_server
+  -hal_keymaster_server
   -system_suspend_server
   -hal_bootctl_server
   -hwservicemanager